8629ac709b
## Phase 1-3: Control Plane + Contract System - awooop_phase1_control_plane_2026-05-04.sql: 12 張核心表 + RLS - awooop_phase1_batch1_rls_2026-05-04.sql: 全部 FORCE RLS + GRANT - packages/awooop-contracts/: 六合約 JSON Schema + golden fixtures - src/models/awooop_contracts.py: Pydantic v2 contract models（extra=forbid） - src/repositories/contract_repository.py: contract lifecycle（draft→published→active） - src/services/contract_service.py: HMAC publish sig + Redis multi-sig activate - src/services/schema_validator.py: LLM output validator（retry×3, E-SCHEMA-001） ## Phase 2: Tenant Isolation - awooop_phase2_budget_ledger_2026-05-04.sql: budget_ledger + RLS - src/services/budget_service.py: Token Budget Hard Kill 三層防線 - src/core/context.py: PROJECT_ID ContextVar（31 background loop 自動繼承） - src/db/base.py + models.py: project_id 欄位 + RLS set_config 注入 - src/hermes/nl_gateway.py: project_id Redis key 前綴（Phase A 雙寫） - src/services/anomaly_counter.py: per-project 改造（Phase A fallback） ## Phase 4: Platform Shell in Shadow Mode - awooop_phase4_run_state_2026-05-04.sql: run_state + step_journal + idempotency - src/services/run_state_machine.py: 8-state FSM + SKIP LOCKED + stale reaper - src/services/platform_runtime.py: UUID v7 + W3C trace_id + shadow_execute - src/services/audit_sink.py: PII/secret redaction 9 patterns - src/api/v1/platform/runs.py: POST/GET /v1/platform/runs（Router→Service 架構） - src/workers/platform_worker.py: SKIP LOCKED worker + heartbeat + reaper loop - src/main.py: platform router + lifespan worker start/stop ## Phase 5: MCP Gateway 五閘門 - awooop_phase5_mcp_gateway_2026-05-04.sql: 4 表 + RLS - src/plugins/mcp/gateway.py: McpGateway（Gate 1~5, E-MCP-GATE-001~009） - src/plugins/mcp/redaction_middleware.py: 雙層 redaction + 16K 截斷 - src/plugins/mcp/registry.py: __provider name mangling（ADR-116） - src/plugins/mcp/credential_resolver.py: k8s secret ref 解析 - tests/test_mcp_credential_isolation.py: 10 個迴歸測試（secret leak 防再現） ## Phase 6-8: EwoooC + Channel Hub + Approval Token - awooop_phase6_ewoooc_onboarding_2026-05-04.sql: ewoooc tenant + 4 read-only MCP tools - awooop_phase7_channel_hub_2026-05-04.sql: conversation_event + outbound_message - src/services/provider_proxy.py: ProviderProxy + PlatformEnvelope（ADR-115） - src/services/channel_hub.py: Telegram inbound mirror + Progressive Feedback（30s） - src/services/awooop_approval_token.py: HS256 + jti NX replay 防護 + suggest mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
90 lines
2.6 KiB
JSON
90 lines
2.6 KiB
JSON
{
|
||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||
"$id": "https://awooop.platform/contracts/v1/mcp_gateway",
|
||
"title": "MCP Gateway Contract",
|
||
"description": "AwoooP MCP Gateway 合約 — 定義工具閘道的傳輸層、認證與速率控制",
|
||
"type": "object",
|
||
"required": ["gateway_id", "gateway_name", "transport"],
|
||
"additionalProperties": false,
|
||
"properties": {
|
||
"gateway_id": {
|
||
"type": "string",
|
||
"pattern": "^[a-z0-9][a-z0-9_-]{1,127}$",
|
||
"description": "Gateway 識別符"
|
||
},
|
||
"gateway_name": {
|
||
"type": "string",
|
||
"minLength": 1,
|
||
"maxLength": 256,
|
||
"description": "人類可讀名稱"
|
||
},
|
||
"transport": {
|
||
"type": "string",
|
||
"enum": ["stdio", "http", "sse"],
|
||
"description": "MCP 傳輸協議（ADR-113）"
|
||
},
|
||
"endpoint": {
|
||
"type": "string",
|
||
"format": "uri",
|
||
"description": "Gateway 端點 URL（transport=http/sse 時必填）"
|
||
},
|
||
"auth_scheme": {
|
||
"type": "string",
|
||
"enum": ["none", "bearer", "hmac"],
|
||
"default": "none",
|
||
"description": "認證方式"
|
||
},
|
||
"hmac_secret_ref": {
|
||
"type": "string",
|
||
"description": "HMAC secret 的 K8s Secret key ref（auth_scheme=hmac 時使用）"
|
||
},
|
||
"tools_exposed": {
|
||
"type": "array",
|
||
"items": {
|
||
"type": "object",
|
||
"required": ["tool_name", "schema_sha256"],
|
||
"additionalProperties": false,
|
||
"properties": {
|
||
"tool_name": {"type": "string"},
|
||
"description": {"type": "string"},
|
||
"schema_sha256": {
|
||
"type": "string",
|
||
"pattern": "^[0-9a-f]{64}$",
|
||
"description": "工具 input schema 的 SHA-256（確保合約不可竄改）"
|
||
},
|
||
"is_destructive": {
|
||
"type": "boolean",
|
||
"default": false,
|
||
"description": "工具是否具破壞性（影響 require_approval 判斷）"
|
||
}
|
||
}
|
||
},
|
||
"description": "此 gateway 暴露的工具清單"
|
||
},
|
||
"rate_limit_rpm": {
|
||
"type": ["integer", "null"],
|
||
"minimum": 1,
|
||
"description": "每分鐘最大 tool call 次數；null = 無限制"
|
||
},
|
||
"timeout_seconds": {
|
||
"type": "integer",
|
||
"minimum": 1,
|
||
"maximum": 300,
|
||
"default": 30,
|
||
"description": "單次 tool call 超時秒數"
|
||
},
|
||
"is_enabled": {
|
||
"type": "boolean",
|
||
"default": true,
|
||
"description": "Gateway 是否啟用"
|
||
}
|
||
},
|
||
"if": {
|
||
"properties": {"transport": {"const": "http"}},
|
||
"required": ["transport"]
|
||
},
|
||
"then": {
|
||
"required": ["endpoint"]
|
||
}
|
||
}
|